Can we stop WannaCry from being spread across network?

  • 6
  • 4
  • Article
  • Updated 1 year ago
WannCry ransomware worm gets through SMB and other protocols.
There is a possible way to block these commands using ACL rule as follows:

ip access-list BROADCAST-MULTICAST-CONTROL
  • permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
  • permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
  • deny tcp any eq 445 any eq 445 rule-precedence 17 rule-description "deny SMB Traffic"
  • deny tcp any eq 139 any eq netbios-ssn rule-precedence 18 rule-description "deny SMB Traffic"
  • deny tcp any eq 137 any eq netbios-ns rule-precedence 19 rule-description "deny SMB Traffic"
  • deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
  • deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
  • deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
  • permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
Some lines are already there but some shall be added.
IP ACL shall be then used on every WLAN in outbound direction and optionally on physical interfaces also.

Some more details on web 

Regards,
Ondrej
Photo of Ondrej Lepa

Ondrej Lepa, Employee

  • 5,638 Points 5k badge 2x thumb

Posted 1 year ago

  • 6
  • 4
Photo of Brandon Clay

Brandon Clay, Escalation Support Engineer

  • 13,486 Points 10k badge 2x thumb
Great article, Ondrej!
Photo of Timo

Timo

  • 3,210 Points 3k badge 2x thumb
Hi,
thank you for the information. Any idea, if Windows CE / Windows Mobile devices also effect? I think based on the different hardware architecture maybe not, but can't find any information about it.
BR Timo
Photo of Ondrej Lepa

Ondrej Lepa, Employee

  • 5,638 Points 5k badge 2x thumb
Hey Timo,

I cannot be official in answer, but doing some research you might find this document on CERT.EUROPA.EU website.
See page 3, Products Affected

Regards,
Ondrej
(Edited)
Photo of Timo

Timo

  • 3,210 Points 3k badge 2x thumb
Hi,
Thank you. I also get some feedback from ZEBRA, that Windows CE / Mobile not affected.
BR Timo
Photo of Mareen

Mareen

  • 364 Points 250 badge 2x thumb
Nice thank you :)
Photo of Alexandr P

Alexandr P, Embassador

  • 12,670 Points 10k badge 2x thumb
Hi, all!

Some question from my colleagues:
- how is feel AD and Exchange authentication (user login) in domain-based network after deny all SMB traffic?

Thank you!
Photo of Alexandr P

Alexandr P, Embassador

  • 12,670 Points 10k badge 2x thumb
Update:

Find some explanation, example:
Client A (XP) connects to Server B (2K8) over port 445. Since it's a TCP connection, Server B needs to be able to contact Client A over a port...the port used will be an ephemeral port (1025-5000 for WinXP & 2K3, 49blah-65535 for Vista & 2K8+). RPC also happens to use these ports. Client A connects to Server B over port 135 (the RPC endpoint mapper). Server B then connects to Client A over it's ephemeral port (lets say 1134) and tells it to use port 49278 for this RPC connection. All future communications between Server B and Client A will be over port 49278 going to the server, and 1134 going to the client.

So ports 137-139 and 445 is blocked only "outbound direction" because in this direction AD use higher ephemeral ports?

Am I right or not?

Thank you!
Photo of Ondrej Lepa

Ondrej Lepa, Employee

  • 5,638 Points 5k badge 2x thumb
Hi Alexandr,

as ACL blocks it only outbound, means that client will be able to get to the server and, if above description is correct, server will be able to get back to client.

Honestly, we are shooting a fly with a bazooka, but if GPO are loose enough not to block SMBv1, then this might be very quick remedy to prevent worm from excessive spread. Not saying it is perfect though...

I cannot speak officially so for confirmation I strongly advise you to contact Microsoft support to get this correctly answered.

Regards,
Ondrej
Photo of Alexandr P

Alexandr P, Embassador

  • 12,670 Points 10k badge 2x thumb
OK.

You wrote that we have to put this ACL in outbound direction, BUT.
Client talk with server by ports 445, 137-139.
(By Wireless_User_Guide - outbound traffic in ACL is from Client to Network, inbound traffic is from Network to client)

So, we have to put this ACL in inbound direction? Isn't it?

Thank you!
Photo of Ondrej Lepa

Ondrej Lepa, Employee

  • 5,638 Points 5k badge 2x thumb
Alexandr,

Could you advise what particular guide you refer to?
In WiNG systems the direction respects the radio point of view



Direction outbound means Tx on radio.
Usin ACL in OUT direction will be then used to block outgoing traffic.
We usually use it to limit VLAN bcast.

Regards,
Ondrej